[1.4.x] Fixed #20707 -- Added explicit quota assignment to Oracle test user
To enable testing on Oracle 12c
[1.4.x] Prevented arbitrary file inclusion with {% ssi %} tag and relative paths.

Thanks Rainer Koirikivi for the report and draft patch.

This is a security fix; disclosure to follow shortly.

Backport of 7fe5b656c9 from master
Added 1.4.7 release notes

Backport of baec6a26dd from master
[1.4.x] Bump version numbers for 1.4.7 security release.
Fixed failing test introduced by 87d2750b39.

The {% ssi %} tag in Django 1.4 doesn't support spaces in its argument.
Skip the test if run from a location that contains a space.
[1.4.x] Bump version post-release.
Merge pull request #1616 from loic/fix1.4

Fixed failing test introduced by 87d2750b39.
[1.4.x] Fixed #20887 -- Added a warning to GzipMiddleware in light of BREACH.

Thanks EvilDMP for the report and Russell Keith-Magee
for the draft text.

Backport of da843e7dba from master
Fixed #18923 -- Corrected usage of sensitive_post_parameters in contrib.auth

Thanks Collin Anderson for the report.

Backport of 425d076d0c from master
[1.4.x] Ensure that passwords are never long enough for a DoS.

 * Limit the password length to 4096 bytes
  * Password hashers will raise a ValueError
  * django.contrib.auth forms will fail validation
 * Document in release notes that this is a backwards incompatible change

Thanks to Josh Wright for the report, and Donald Stufft for the patch.

This is a security fix; disclosure to follow shortly.

Backport of aae5a96d5754ad34e48b7f673ef2411a3bbc1015 from master.
[1.4.x] Add release notes and bump version numbers for 1.4.8 security release.
[1.4.x] Removed usage of b"" string syntax for Python 2.5 compatibility.

Refs commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.
[1.4.x] Fixed geos test to prevent random failure

Points in the test fixtures have 20 as max coordinate.

Backport of 87854b0bdf354059f949350a4d63a0ed071d564c from master.
[1.4.x] Bump version post-release.
[1.4.x] Cleaned up 1.4.8 release notes

Backport of 8d29005524 from master
Revert "[1.4.x] Ensure that passwords are never long enough for a DoS."

This reverts commit 3f3d887a6844ec2db743fee64c9e53e04d39a368.

This fix is no longer necessary, our pbkdf2 (see next commit) implementation
no longer rehashes the password every iteration.
[1.4.x] Fixed #21138 -- Increased the performance of our PBKDF2 implementation.

Thanks go to Michael Gebetsroither for pointing out this issue and help on
the patch.

Backport of 68540fe4df44492571bc610a0a043d3d02b3d320 from master.